更新聯合規則

FederationRule Organization.Federation.Rules.Update(parameters, cancellationToken = default)

POST/v1/organizations/federation_rules/{federation_rule_id}

需要具有 org:admin 範圍的 OAuth 存取權杖，可透過 ant auth login --scope org:admin 或工作負載身分聯合（workload identity federation）規則取得；不接受 Admin API 金鑰。請參閱使用 Admin API 管理 WIF。

部分更新聯合規則。

issuer_id 無法變更。設定 match 和 target 時，會以整個物件取代。所參照的服務帳戶與工作區必須存在於您的組織中；無效的參照會以 400 錯誤拒絕。已封存的規則無法更新；此操作會傳回 400。請改為建立新的規則。位於知名共用簽發者（GitHub Actions、GitLab、Buildkite、Terraform Cloud、Google）上的規則，必須透過帶有身分的宣告、固定租用戶的主體前綴（例如 repo:YOUR_ORG/...），或參照上述身分宣告之一的 CEL 條件（例如 claims.repository_owner）來限制租用戶身分。在這些簽發者上，每次更新都會重新檢查此要求；若現有規則儲存的比對條件尚未限制租用戶身分，則任何更新（即使只是重新命名或變更描述）都必須在同一請求中一併提供符合規定的 match。OAuth 呼叫者只能管理 oauth_scope 為 workspace:developer 或 workspace:inference 的規則；其他範圍需要 Console 工作階段。

Parameters

RuleUpdateParams parameters

required string federationRuleID⁠Path

ID of the federation rule to update.

bool? appliesToAllWorkspaces

When true, enables this rule for every workspace in the org (including workspaces created later). Setting false is rejected with 400 if no workspace would remain enabled; a rule with only a legacy workspace_id binding continues to mint.

string? description

Replaces the description. Omit to leave unchanged; send null to clear (the field is stored as an empty string).

maxLength2000

FederationRuleMatch? match

Replaces the entire match object. All populated matcher fields must pass.

string? name

Replaces the slug identifier (lowercase, digits, hyphens). Unique within the organization; a duplicate name returns 409.

minLength1

maxLength255

string? oauthScope

Replaces the space-separated OAuth scopes granted on minted tokens. OAuth callers may only set workspace:developer or workspace:inference; other scopes (such as org:admin) require a Console session.

minLength1

ServiceAccountTarget? target

Replaces the entire target object. Currently always a service_account target.

long? tokenLifetimeSeconds

Replaces the lifetime in seconds for access tokens minted via this rule (60-86400). Minted tokens are capped at max(60, min(this value, 2 × remaining assertion validity)) seconds.

minimum60

maximum86400

string? workspaceID

Replaces the existing single workspace enablement (the previous one is removed). Rejected with 400 if the rule is enabled for more than one workspace; use the /federation_rules/{federation_rule_id}/workspaces sub-resource instead.

Returns

class FederationRule { Type = "federation_rule"; ID; AppliesToAllWorkspaces; /* 15 more */ }

Authorization rule binding an external OIDC identity to Anthropic.

Evaluates the match conditions and mints an OAuth access token for the resolved target, scoped to a single workspace where the rule is enabled (chosen by the caller at exchange time when the rule is enabled for more than one). For rules enabled via workspace_ids or applies_to_all_workspaces, the target service account must be a member of that workspace (it is implicitly a member of the default workspace); rules carrying only the legacy workspace_id binding do not enforce this.

更新聯合規則

using System;
using Anthropic.Models.Organization.Federation.Rules;

RuleUpdateParams parameters = new() { FederationRuleID = "federation_rule_id" };

var federationRule = await client.Organization.Federation.Rules.Update(parameters);

Console.WriteLine(federationRule);

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}

Returns Examples

Response 200

{
  "id": "fdrl_01SDCCSbTxrXDpWc1phhtcfK",
  "applies_to_all_workspaces": true,
  "archived_at": "2019-12-27T18:11:19.117Z",
  "archived_by_actor_id": "archived_by_actor_id",
  "attributes": {
    "foo": "string"
  },
  "created_at": "2024-10-30T23:58:27.427722Z",
  "created_by_actor_id": "created_by_actor_id",
  "description": "description",
  "issuer_id": "issuer_id",
  "issuer_name": "issuer_name",
  "match": {
    "audience": "audience",
    "claims": {
      "foo": "string"
    },
    "condition": "condition",
    "subject_prefix": "subject_prefix"
  },
  "name": "prod-deploy-pipeline",
  "oauth_scope": "oauth_scope",
  "target": {
    "service_account_id": "svac_01SDCCSbTxrXDpWc1phhtcfK",
    "type": "service_account",
    "service_account_name": "service_account_name"
  },
  "token_lifetime_seconds": 0,
  "type": "federation_rule",
  "updated_at": "2024-10-30T23:58:27.427722Z",
  "updated_by_actor_id": "updated_by_actor_id",
  "workspace_id": "workspace_id",
  "workspace_ids": [
    "string"
  ]
}